Why is it you (or someone there) chose "Secure" in the address bar rather than something like "Private"? It seems like the people who don't understand what httpS means at all see "Secure" and think "oh this site is safe/secure" no matter what this site is, like if it's a phishing site. I'm not one to be very pedantic, but "Secure" up there really doesn't mean "Secure" at all. I know what it means, but people falling for dangerous sites don't get that at all. I don't really know what the best word is, but "Secure" seems like not the best choice there.
[Edit] Thank you to those people who had some honest replies, not sure why this got down voted, it was an honest question. When you go to the "Learn More" page on Chrome it doesn't even say "Secure" it says "Information you send or get through the site is private."
Couldn't "private" also not mean "private"? For instance: when you're on Facebook, couldn't people think they are exchanging private messages because the address bar says "private"?
"secure" means "secure connection" to me, and it sounds perfectly appropriate. Maybe you can't find a better term for "secure" because it's perfectly fine, already..?
This is bikeshedding. The only users who would be able to distinguish the meaning of "secure" and "private" in their address bar are people who already understand what https is and isn't.
Fair. Its just that this very complaint has been brought up by a number of people asking it dishonestly as a way of discouraging the move towards ssl on all websites. That's why it raises eyebrows.
But the extras beyond encryption are definately not guarantees. [1] HTTPS means encrypted HTTP. Everything else is "I trust the certificate authority to provide oversight and verification." It may just be me, but I don't trust the fine, upstanding CAs we have now-a-days.
1: https://stripe.ian.sh/
Authenticity indeed is only guaranteed if you trust the CAs. Though it is still nice to know that getting a false cert isn't trivial.
However, message integrity is a real benefit of SSL that doesn't need CAs. Consider the original article. In this case encryption doesn't matter and integrity does.
Without message integrity, considering the login link has a known location and value, using bit-flips one might be able to change the login link (depending on the kind of encryption used).
This message integrity is getting to be a much more important part of https. There are a lot of things that you don't want other parties able to change. Maybe even more things than you don't want them to be able to read.
That's my point. There is no guarantee about authenticity. Anyone can register a domain and have an SSL cert from Let's Encrypt in less than 15 minutes.
The only thing that HTTPS guarantees is that you are communicating securely with the person that owns the domain. That's it.
This is expected to be the long term outcome of (at least) Google and Mozilla's current trajectory.
Google specifically says (without naming a date) that their long term intent is to put a UI like a red triangle plus the phrase "Not Secure" in the URL bar for all HTTP sites on their desktop browser. This is the same treatment you get today for a site with a bogus SSL certificate and similar to the treatment HTTP sites get now in Incognito mode.
[Edit] Thank you to those people who had some honest replies, not sure why this got down voted, it was an honest question. When you go to the "Learn More" page on Chrome it doesn't even say "Secure" it says "Information you send or get through the site is private."